I am setting up a web api for the first time and I have another project for reference. It is a .NET framework project that will have a React frontend. I am running it using Visual Studio and IIS Express.
I have no build errors when I start the api project. It has swagger added so I can test database calls, so I know the api itself is working. But I am missing adding something as I am looking to add more security to it.
I am trying to verify authentication and I want to use integrated Windows authentication. When I set a break point, the user in the HttpContext.Current is never set and is never authenticated, so I can't add any authorization filters.
I went back to just the basic empty api project that has the frontend web pages removed to see if I removed something and it shows the same issue. So I either removed it again or I am actually missing adding something.
I am not sure where to look for what is missing, so any pointers would be appreciated.
The left browser is what I am expecting and the right browser is what I am seeing.
I don't need the directory browse turned on, so seeing a 403.14 - Forbidden is fine. But I am clearly missing something to get to that point. Is there a better way to figure out which resource/dependency is causing this error?
I can also see the working version requested url is what I am expecting, but the other is just a /. Is there a way to resolve that if this is the error?
I can add code snippets if needed, but I haven't yet as I am not sure where the issue is.
I ended up finding the answer using blank test web apis to see what I may have left in that wasn't needed. The project was set up using this option:
After removing the views, etc., to make it strictly an api project. I started removing references (and clearing the associated errors) and seeing what happened with the build after each change.
Under the App_Start folder, there were some additional files that weren't present in the project I had for comparison - FilterConfig, and RouteConfig - which were also called in the Global.asax.
I removed the call in Global.asax for all three and I was able to see the expected http error page.